Check Point VPN Flaws CVE-2026-85102/85103: Dutch NCSC Warns Exploitation Is Imminent

Check Point has shipped fixes for two critical vulnerabilities in the VPN code of its Security Gateway, Security Management Server, and Spark FirewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. products. Both are rated CVSS 9.8, both are reachable by an unauthenticated attacker on the network, and both sit in the code that processes a peer's certificate before any trust has been established. The Dutch national cyber security centre (NCSC-NL) has gone further than the vendor and told organisations to expect large-scale exploitation attempts soon. If you run a Check Point gateway with Site-to-Site or Remote Access VPN enabled, this is the patch to do today.

What Happened

On 9 September 2026 Check Point published two advisories, sk1000117 and sk1000118, each covering one CVE:

• CVE-2026-85102 is described as an authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. and remote code execution flaw in Remote Access and Site-to-Site VPN. The root cause is improper validation of certificate data during VPN negotiation. An unauthenticated remote attacker who reaches the VPN listener can execute arbitrary code on the Security Gateway.
• CVE-2026-85103 is a heap overflowHeap Overflow🛡️A memory-corruption bug where a program writes more data into a heap allocation than it was sized to hold, spilling into adjacent memory. When the overwritten neighbor is the allocator's own bookkeeping, an attacker can steer it toward code execution. in the ASN.1ASN.1🛡️Abstract Syntax Notation One, a standard for describing structured data as tag-length-value elements. X.509 certificates are ASN.1 encoded, so every TLS and IPsec endpoint contains an ASN.1 decoder that runs on untrusted input, a frequent source of memory-safety bugs. decoding flow used for VPN certificates. Successful exploitation also gives remote code execution, and this one additionally affects the Security Management Server, not just gateways.

According to SecurityWeek's 11 September report, Check Point found both bugs internally and stated it had no evidence of in-the-wild exploitation. Fixes started rolling out automatically through Check Point's LivePatch mechanism on 9 September for supported releases, and Jumbo HotfixHotfix🛡️An out-of-cycle software update that addresses a specific urgent defect, usually a security flaw, on an existing release line without waiting for the next scheduled version. Hotfixes are typically numbered and cumulative on that line, but each covers only the issues named in its notes, so a later one may be required. Accumulator takes followed for administrators who prefer a conventional package.

The next day, 10 September, NCSC-NL issued advisory NCSC-2026-0365 and a public alert. The agency rated both the likelihood of exploitation and the potential damage as high, and said it expects active exploitation attempts on a large scale in the near term. BleepingComputer picked the warning up on 12 September, noting that no public proof-of-concept had been reported at that point.

As of the CISA Known Exploited Vulnerabilities catalog version released on 11 September, neither CVE is listed. That is consistent with the vendor's position that exploitation has not been observed. It does not mean the risk is low; it means the clock has not started yet.

Who Is Affected

Both advisories list the same affected release lines:

• R81.20, R82, and R82.10 on Security Gateway (and, for CVE-2026-85103, Security Management Server)
• Spark Firewall R81.10.x and R82.00.x, whether centrally or locally managed
• R80, R80.10, R80.20, R80.30, R80.40, R81, and R81.10, all of which are end of support and will not receive a fix

R82.20 is not affected.

The precondition is a VPN configuration. For CVE-2026-85102 the advisory names Site-to-Site VPN or Remote Access VPN specifically; for CVE-2026-85103 it says VPN configuration is required. In practice almost every internet-facing Check Point gateway meets that bar, because terminating IPsecIPsec🌐A suite of protocols that authenticates and encrypts IP traffic at the network layer, used for site-to-site tunnels between gateways and for many remote-access VPNs. IKE handles the negotiation; ESP carries the protected packets. tunnels and remote-access clients is a large part of why organisations buy the product. A management server is a less obvious target, but CVE-2026-85103 puts it in scope, and a compromised management server hands an attacker the policy and credentials for every gateway it controls.

The end-of-support list matters. R80.x and R81.10 gateways are still common, and those devices have the vulnerable code with no patch path other than a version upgrade.

Technical Analysis

Both bugs live in the same conceptual place: the parsing of certificate material presented by a peer during the IPsec key exchange. Certificate-based authentication in IKE means the gateway has to receive a blob of ASN.1-encoded X.509 data from whoever connects, decode it, and validate it, all before it can decide whether the peer is trustworthy. That decode-then-decide ordering is unavoidable, and it is exactly why this code is pre-authentication attack surfaceAttack Surface🛡️The sum of all points where an unauthorized user could attempt to enter or extract data from a system: exposed services, interfaces, accounts, and integrations. Reducing attack surface means removing reachability, not just patching.. The peer controls every byte of the input, and the gateway has to process it to find out who the peer is.

CVE-2026-85102 is the logic failure: certificate data is not validated properly, and the result is that an attacker can bypass authentication controls and reach code execution. CVE-2026-85103 is the memory-safety failure: a heap overflow in the ASN.1 decoder. ASN.1 parsers have a long history of length-field bugs, because the encoding lets the sender declare how long each element is and a careless decoder trusts that declaration when it allocates or copies. The advisory does not give exploitation details, and no public write-up existed at the time of writing, so treat the mechanics beyond that as unknown. The article on why VPN certificate parsing is pre-authentication attack surface covers the general class in more depth.

The heap overflow is the more worrying of the pair. It reaches the management server, and heap corruption in a long-running appliance daemon is the pattern behind most recent edge-device zero-days; once someone reverses the patch, working exploits tend to follow. NCSC-NL's assessment that exploitation is imminent reads as a judgement about that pattern rather than about any observed activity.

Check Point has been here before. In May 2024, CVE-2024-24919 in the same product family was exploited as a zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it. against gateways with Remote Access VPN or Mobile Access enabled. That was an information-disclosure bug rather than code execution, but Help Net Security reported that attackers used it to pull password hashes and, in one case observed by mnemonic, extracted the Active Directory database within a few hours of logging in with a stolen local account. More recently, CISA added a Check Point SmartConsole authentication flaw, CVE-2026-16232, to its KEV catalog on 22 July 2026. The vendor is a repeat entry on the exploited-in-the-wild list, and attackers know the product.

Immediate Actions

Patch first. There are two supported routes, and the advisories give exact identifiers for each.

1. LivePatch. Supported releases R82.10, R82, and R81.20 receive the bundle named BUNDLE_URGENT_SECURITY_UPDATE, Take 24, automatically if LivePatch is enabled. BleepingComputer reports it applies without a reboot. Confirm it landed rather than assuming it did; the advisory says to check with the cpinfo -y CPupdates command.
2. Jumbo Hotfix Accumulator. The fixed takes are R82.10 Take 44 and later, R82 Take 126 and later, and R81.20 Take 166 and later. Spark Firewall fixes are R82.00.10 Build 2325 and later and R81.10.17 Build 4968 and later.

Locally managed Spark Firewalls need the hotfix; the network workaround below does not apply to them, per both the vendor and SecurityWeek.

If you cannot patch immediately, the advisory offers a narrowing workaround for Site-to-Site VPN: disable the implied rules for VPN and manually define access for UDP/500 and UDP/4500 from the specific peer IP addresses only. That turns the VPN listener from an internet-wide service into one reachable by known peers. It does nothing for Remote Access VPN, where by definition the client population comes from arbitrary addresses. The guide on how to lock down IKE and IPsec ports to known VPN peers walks through the general version of that change and how to verify it.

Then inventory. Every gateway and management server on R80.x through R81.10 is unpatchable and needs an upgrade plan with a date on it. Every remote-access endpoint that is exposed to the internet and not yet at a fixed take is the highest-priority host on your network right now.

Finally, decide what you will do if exploitation is confirmed next week. There are no public indicators of compromise yet. Reasonable places to watch in the meantime are VPN daemon crashes or restarts on the gateway, unexpected processes on the gateway or management host, and IKE negotiation attempts from addresses that are not configured peers. If you later find evidence a gateway was reached, the existing guidance on rebuilding a compromised VPN appliance applies, and the piece on why live patchingLive Patching🛡️Applying a security fix to running software on an appliance or server without a full upgrade or reboot, often delivered automatically by the vendor. It shortens the exposure window but typically covers only supported releases and does not replace the full fixed release. perimeter appliances covers less than it seems explains why a hot-patched gateway still needs the full hotfix and a maintenance window.

Long-Term Outlook

The vendor patched quietly and said nothing about exploitation; a national CERT looked at the same two advisories and told the public to brace. Both can be right. Internally discovered bugs in a widely deployed edge product have a short shelf life once the patch is out, because the diff is the exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. roadmap. Organisations that wait for a KEV entry before acting are waiting for someone else to be breached first.

Watch for three things over the coming weeks: a KEV addition for either CVE, a public proof-of-concept for the ASN.1 heap overflow, and vendor indicators of compromise. Any one of those should trigger a re-check that every gateway really is at a fixed take. The end-of-support fleet is the longer problem. A perimeter device that can no longer receive security fixes is a liability regardless of what it says on the licence, and this advisory is a good excuse to put the upgrade on the calendar.

Sources

• Check Point sk1000117, CVE-2026-85102: https://support.checkpoint.com/results/sk/sk1000117
• Check Point sk1000118, CVE-2026-85103: https://support.checkpoint.com/results/sk/sk1000118
• NCSC-NL advisory NCSC-2026-0365: https://advisories.ncsc.nl/2026/ncsc-2026-0365.html
• NCSC-NL public alert: https://www.ncsc.nl/alerts/kritieke-kwetsbaarheden-in-check-point-vpn-producten-met-actief-misbruik-verwacht-update-nu
• BleepingComputer, 12 September 2026: https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/
• SecurityWeek, 11 September 2026: https://www.securityweek.com/check-point-patches-critical-vpn-vulnerabilities/
• CISA KEVCISA KEV🛡️The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patch by specific deadlines. catalog feed (catalog 2026.09.11): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• Help Net Security on CVE-2024-24919: https://www.helpnetsecurity.com/2024/05/31/cve-2024-24919/